#tooling

CLI

A collection of command line related notes. Mostly things I can't quite remember.

Luca Pette · EN

Speeding Up Checkout in a Fast-Growing Monorepo with Blacksmith

We swapped actions/checkout for Blacksmith's cached checkout across our GitHub Actions. Mean checkout time dropped from 69s to 20s, reclaiming ~33 hours of runner time each weekday.

Nicolas Charpentier's Blog · EN

Surgical Transitive Updates with pnpm: audit --fix

pnpm's audit --fix can now update vulnerable transitives directly in the lockfile instead of reaching for overrides first, and it even plays nicely with minimumReleaseAge. Let's dig in.

Nicolas Charpentier's Blog · EN

The Bun CVE Gap, Closed: Surgical Updates Land in Bun 1.4

Three months ago, I wrote that Bun was the only mainstream package manager that couldn't do surgical CVE remediation. Bun 1.4 ships in-place transitive updates, bun audit fix, and nested overrides. Time to re-run the original reproductions.

Nicolas Charpentier's Blog · EN

Enforcing Best Practices with Jev as a Linter

Agents write most of our code now, and they respond to checks far more reliably than to documents. I turned a best practice written in plain English into a lint rule with Jev and Oxlint, annotated inline in GitHub pull requests.

Nicolas Charpentier's Blog · EN

The Bun Dependabot Gap: Dependabot Alerts Don't See bun.lock

GitHub's dependency graph doesn't read bun.lock yet, so in Bun projects Dependabot alerts only cover what's written in package.json, and never a transitive dependency. Here's how to check if you're affected, and how I closed the gap with a GitHub Action.

Nicolas Charpentier's Blog · EN